Vulnerability details
CVE-2026-9032
TP-Link Systems Tapo C120 v1TP-Link Systems Tapo C200 v5
Unauthenticated Onboarding Connect NULL Pointer Dereference Denial of Service Vulnerability in TP-Link Tapo C120 & C200
CVSS 4.0
7.1High
Official description
Tapo C120 v1 and C200 v5 contain a NULL pointer dereference in the HTTPS onboarding connect request parser. The interface is reachable without authentication after initial setup and does not validate that a password field is present for certain authentication and encryption parameter combinations, allowing a malformed request from the same local network to crash the HTTPS service Successful exploitation may temporarily make HTTPS management functions unavailable. Repeated malformed requests may sustain the denial-of-service condition, and recovery may in some cases require a device reboot.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.1High | 4.0 | CVEProject cvelistV5 (CNA) (TPLink) | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| TP-Link Systems Inc. | Tapo C120 v1 | v < V1_1.9.4 Build 260813 Rel.79754n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | Tapo C200 v5 | v < V5_1.4.6 Build 260709 Rel.27675n | CVEProject cvelistV5 (CNA) |
References and advisories
5- https://www.tp-link.com/us/support/download/tapo-c200/v5/#Firmware-Release-Notes patch
- https://www.tp-link.com/en/support/download/tapo-c200/v5/#Firmware-Release-Notes patch
- https://www.tp-link.com/us/support/download/tapo-c120/v1.26/#Firmware-Release-Notes patch
- https://www.tp-link.com/en/support/download/tapo-c120/v1.26/#Firmware-Release-Notes patch
- https://www.tp-link.com/us/support/faq/5321/ vendor-advisory
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-10-01
- Last updated
- 2026-10-06
- State
- Published
- Assigner (CNA)
- TPLink
Exploit prediction (EPSS)
0.15%
Probability of exploitation in 30 days
4.8%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-476NULL pointer dereference